Slot Flow Privacy Policy

Last updated: [date]

1. Who we are

Slot Flow is run by Slot Flow Ltd, a private company limited by shares, registered in England and Wales (company number 17031737). Our registered office is 58A Tudor Road, Hayes, England UB3 2QD.

• Privacy contact: privacy@getslotflow.com
• ICO registration number: [ICO registration number]
• EU representative (if needed, see section 13): [name and address, or "not applicable"]

Slot Flow is software for businesses (we call them "Business Customers"). It lets them collect feedback from their own customers through branded forms and QR codes, see sentiment across their locations, and follow up personally.

This policy explains what personal data we handle, why, and what rights you have. It's written in plain English. If anything is unclear, email us.

2. Our two roles: controller and processor

The law treats us differently depending on whose data it is.

If you left feedback for a business (for example a restaurant, clinic or garage that uses Slot Flow), that business is responsible for your data. Its own privacy notice applies, and you should contact it first to exercise your rights. If you contact us, we'll pass your request to the right business and help them respond.

3. Data we collect as controller

Account data. Name, work email, company name, job role, password or sign-in details (handled by our authentication provider), and workspace settings.

Billing data. Billing name and address, VAT number, plan, invoices and payment status. Card details are taken and stored by our payment provider, not by us. We only see limited details such as card type and the last four digits.

Usage and technical data. Log-in times, features used, IP address, device and browser type, error logs, and security events.

Communications. Emails and support messages you send us, and whether you open our service emails.

Website visitors. Basic technical data and cookie data (see section 10). If you sign up for updates, your email address.

4. Why we use it and our lawful basis (controller data)

We don't sell personal data. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Feedback data we process for Business Customers

When a Respondent fills in a form, we process the following on the Business Customer's behalf: the rating, answers and comments; the location and form used; the time and date; basic technical data (such as IP address and browser, for security and spam prevention); and any contact details the Respondent chooses to give.

We use this data only to provide the service to that Business Customer. That includes AI-assisted sentiment analysis and AI-prepared draft replies, which a person reviews before use. We don't use Respondent data for our own marketing. We don't sell it. We don't use it to train general-purpose AI models [confirm this with your AI provider's terms]. The Business Customer decides how long it is kept, and can delete it.

Our data processing agreement ([link to DPA]) sets out these commitments in full, as required by UK GDPR Article 28.

6. Who we share data with (subprocessors)

We use trusted service providers to run Slot Flow. They can only use the data to provide their service to us, under written contracts.

We'll keep an up-to-date list at [link to subprocessor page] and give Business Customers notice before adding or replacing a subprocessor that handles Respondent data, as set out in the DPA.

We may also share data:

• with professional advisers (lawyers, accountants) under confidentiality duties;
• with police, regulators or courts where the law requires it;
• with a buyer or investor if Slot Flow Ltd is sold, merges or restructures, in which case this policy will still protect your data.

7. International transfers and access from outside the UK

Some of our providers process data outside the UK, mainly in the USA (see section 6). Our founder and some team members work from Pakistan and may need to access personal data from there to run, support and fix the service.

The UK doesn't have an "adequacy" decision for Pakistan, so we protect this access with:

• Contractual safeguards: the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as appropriate, plus a written transfer risk assessment [to be completed];
• Technical controls: data stays on our UK/US-hosted systems and is accessed remotely, not downloaded or stored on local devices. Access is encrypted in transit (TLS/VPN), protected by multi-factor authentication, logged, and limited to what each person needs;
• Organisational controls: confidentiality obligations, security training, and a policy that Respondent data is only accessed when needed for support or to fix a problem, or when a Business Customer asks.

For other transfers we rely on UK adequacy regulations (for example the UK-US Data Bridge, where the US provider is certified) or the IDTA / UK Addendum. You can ask us for a copy of the relevant safeguards by emailing privacy@getslotflow.com.

8. How long we keep data

9. Your rights

Under UK GDPR you have the right to:

• access a copy of your data;
• correct inaccurate data;
• delete your data (the "right to be forgotten"), in some cases;
• restrict how we use it, in some cases;
• object to processing based on legitimate interests, and always to direct marketing;
• data portability: get data you gave us in a machine-readable format;
• withdraw consent at any time, where we rely on consent.

Email privacy@getslotflow.com. We'll reply within one month (we can extend this by two more months for complex requests and will tell you if we do). It's normally free. We may need to confirm your identity.

Respondents: please contact the business you gave feedback to. We'll help it respond.

10. Cookies and similar technologies

We use:

• Strictly necessary cookies, for sign-in, security and keeping your session. These are set by us and by Clerk. They don't need consent.
• Preference cookies/storage, for example your chosen currency. [Confirm whether consent is needed.]
• Analytics cookies [only if used, e.g. provider name]. We'll only set them with your consent, which you can change at any time via [cookie settings link].

Public feedback forms only use what's strictly necessary to work and to prevent spam [confirm].

You can also block or delete cookies in your browser settings, though sign-in won't work without the necessary ones.

11. Security

We use encryption in transit and at rest [confirm], access controls, multi-factor authentication for staff, logging, and regular backups. No system is perfectly secure. If a breach is likely to put your rights at risk, we'll tell you and the ICO as the law requires. As a processor, we'll tell affected Business Customers without undue delay.

12. Complaints

Please contact us first at privacy@getslotflow.com so we can try to fix it. You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO): www.ico.org.uk, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

13. People in the EU/EEA

If you're in the EU/EEA, the EU GDPR gives you the same rights as in section 9, and you can complain to your local data protection authority. If we offer the service to EU users regularly, we'll appoint an EU representative under Article 27 EU GDPR: [name and contact details, or "not yet appointed"]. Transfers from the EU are protected by EU Standard Contractual Clauses or adequacy decisions (the EU recognises the UK as adequate).

14. People in the United States (including California)

We don't sell or share personal information for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act as amended by the CPRA (CCPA). [Check whether Slot Flow meets the CCPA thresholds. Smaller businesses may be exempt, but these notes are good practice anyway.]

If the CCPA applies, California residents can:

• know what personal information we collect, use and disclose (the categories are in sections 3 to 6: identifiers, commercial/billing information, internet activity, and professional information);
• request deletion and correction;
• opt out of sale or sharing (we don't do either);
• limit use of sensitive personal information (we don't use it for purposes that require this);
• not be discriminated against for using these rights.

Send requests to privacy@getslotflow.com. An authorised agent can make a request on your behalf. For Respondent data we act as a service provider to the Business Customer, so please contact that business first. Other US state privacy laws give similar rights, and we'll honour equivalent requests.

15. Children

Slot Flow is a business service and isn't aimed at children. Business Customers shouldn't use Slot Flow forms to knowingly collect data from children under 13 (or the age set by local law) without appropriate parental consent.

16. Changes to this policy

We'll update this policy when our practices or the law change. We'll show the date at the top, and we'll tell account holders about significant changes by email or in the app.

17. Contact

Slot Flow Ltd, 58A Tudor Road, Hayes, England UB3 2QD Email: privacy@getslotflow.com